I need Apple's Privacy Manifests added and SDK signatures [323059684]

Fixed

Bug

Status Update

No update yet.

Description

ma...@gmail.com

created issue #1

Jan 31, 2024 10:52AM

===========================================================================================

#REMINDER: Please do not disclose any possible PII such as: email address, IP, contact number, any part of name, project numbers and billing accounts as these information may violate security and privacy. Comments or attachments that include PII will be removed and restricted from public viewing.

Furthermore, please refrain from replying to a comment as this will make your email address visible. Instead, you may use the Issue Tracker’s comment feature for your replies.

It is OK to share your API Project ID, but not API keys or client ID credentials.

To learn more about personal data, visit https://en.wikipedia.org/wiki/Personal_data

===========================================================================================

What would you like us to add to this API?

I need Apple's Privacy Manifests added and SDK signatured.

https://developer.apple.com/support/third-party-SDK-requirements/

The MapsSDK is not on the list of "SDKs that require a privacy manifest and signature," but the response from an Apple developer in the forum below includes this response. From reading this, I think we need at least Privacy Manifest support in the Maps SDK.

https://forums.developer.apple.com/forums/thread/743295

Any app and third party SDK that collects data, uses required reason API, or both must include a privacy manifest file. If your app uses an SDK not listed but that falls under the mentioned requirements, then this SDK must include a privacy manifest.

Explain your use case for that feature:

If privacy manifest is supported, Apple will no longer reject apps that use the Maps SDK.

Comments

ca...@google.com <ca...@google.com> Feb 1, 2024 04:10AM

Assigned to ca...@google.com.

ca...@google.com <ca...@google.com> #2Feb 1, 2024 11:39PM

Thank you for posting.

Our engineering team is working on the issue internally. You can star the issue to get notifications when updates are available.

na...@willowtreeapps.com <na...@willowtreeapps.com> #3Mar 19, 2024 02:45PM

Any update on this? Apps will be unable to submit new versions using the Google Maps SDK after May 1st if this is not added.

yu...@google.com <yu...@google.com> #4Mar 20, 2024 06:31PM

The Google Maps Platform team is aware of Apple's announcements regarding third-party SDK privacy manifest and signature and required reason APIs. Although none of the Google Maps Platform SDKs for iOS are listed on Apple's page of "SDKs that require a privacy manifest and signature" as of the date of this message, the team is working on understanding and fulfilling the requirements in anticipation of Apple's requirements of apps that use Google Maps Platform SDKs for iOS. We cannot give a date when a version of the SDK that meets the requirements will be released.

vi...@rea-group.com <vi...@rea-group.com> #5Mar 27, 2024 10:42PM

Just because GoogleMaps SDK is not listed as a priority SDK on SDKs that require a privacy manifest and signature does not mean that apple will allow apps to be submitted on May 1st.

Important

If you upload an app to App Store Connect that uses required reason API without describing the reason in its privacy manifest file, Apple sends you an email reminding you to add the reason to the app’s privacy manifest. Starting May 1, 2024, apps that don’t describe their use of required reason API in their privacy manifest file aren’t accepted by App Store Connect.

If the SDK is not released and updated before the deadline, applications will have to guess the reason that GoogleMaps SDK uses these required reasons and put them in their own Privacy Manifest, likely with inaccurate results.

Message last modified on Mar 27, 2024 10:42PM

na...@willowtreeapps.com <na...@willowtreeapps.com> #6Apr 2, 2024 04:05PM

Can we get an estimate for when a privacy manifest will be included in an update?

As a reminder, apps will not be able to submit new versions to the app store using the Google Maps SDK starting on May 1st if this is not included.

yu...@google.com <yu...@google.com> #7Apr 3, 2024 10:43PM

The installation instructions for Google Maps Platform SDKs for iOS now have download links and instructions for manually adding Privacy Manifest files for use with the latest versions of the SDKs. If you receive feedback from Apple regarding the contents of these privacy manifests, please report that feedback in a comment below. Find instructions and manifests for each SDK at the links below:

vi...@rea-group.com <vi...@rea-group.com> #8Apr 3, 2024 10:58PM

Thanks for the resolution. Is this a temporary solution? Most SDK providers are including the bundling of the manifest in their cocoapod or swift package, therefore simply updating the package is required.

In fact, a manual copy operation is quite disruptive especially considering automation processes. The file linked in the docs is not version controlled or linked to a specific version of the SDK so it may become stale or become incorrect as the SDK is updated. It would make a lot of sense to distribute the bundle as part of the cocoapod or package.

yu...@google.com <yu...@google.com> #9Apr 3, 2024 11:22PM

We recognize and agree that comment#7 is not the ideal solution, and will not close this issue until the complete resolution is delivered. Providing the download links and instructions for manually adding the privacy manifests supports developers using the latest versions of the SDKs, which do not include the privacy manifests.

cr...@gmail.com <cr...@gmail.com> #10Apr 3, 2024 11:41PM

I followed the directions for the Maps SDK above and received the following feedback after submitting a new build to TestFlight:

Although submission for TestFlight review was successful, you may want to correct the following issues in your next submission for TestFlight review. Once you've corrected the issues, upload a new binary to App Store Connect.

ITMS-91053: Missing API declaration - Your app’s code in the “SpeedCoach Mobile” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryDiskSpace. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

This is the same feedback that I received earlier, before applying the instructions from comment #7.

st...@zweitag.de <st...@zweitag.de> #11Apr 4, 2024 03:51PM

Hi! I am using the cocoapods version.
- I created an archive and a Privacy Report prior to adding the GoogleMapsPrivacy.bundle to the project to validate the changes
- Adding the GoogleMapsPrivacy.bundle to the root folder, then creating an archive and generating a Privacy Report did not change the Privacy Report

I then
- dragged the GoogleMapsPrivacy.bundle to my Build Phases -> Copy Bundle Resources phase (and made sure that it would copy the file instead of linking my Downloads folder)
- created another archive and Privacy Report
This made the Nutrition Labels included in the .bundle show up.

Is this the or at least a correct way of including the file?

Message last modified on Apr 5, 2024 09:00AM

wa...@gmail.com <wa...@gmail.com> #12Apr 5, 2024 01:54AM

Does the integration method of Cocoapods support this approach?

comment #7

May I ask if we should place the Google Maps Privacy. bundle file in the root directory of our own project's main project.
Or in the same directory as/Pods/Google Maps/Maps/Resources/Google Maps Resources/Google Maps. bundle.

ma...@umain.com <ma...@umain.com> #13Apr 17, 2024 06:26AM

I am seeing the same issue with cocoa pods integration, adding the privacy file GoogleMapsPrivacy.bundle to the top level directory does not work.
I still get the message from apple about the api usage.

This is the only framework I have that utilises this approach, my question how should apple know that this bundle correspond to your framework if its located in the top directory?

Is the idea that they are mapping the name ${Framework}Privacy.bundle (GoogleMapsPrivacy.bundle) to GoogleMaps.framework somehow?

Because when I'm running the scanner tool to check binary usage of API's I see that maps has three frameworks.
GoogleMapsBase, GoogleMapsCore, GoogleMaps

Used symbols in binary ./XCFrameworkIntermediates/GoogleMaps/Maps/GoogleMapsCore.framework/GoogleMapsCore: lstat, mach_absolute_time, stat
Used symbols in binary ./XCFrameworkIntermediates/GoogleMaps/Maps/GoogleMaps.framework/GoogleMaps: NSFileCreationDate, NSFileModificationDate, NSURLContentModificationDateKey, NSUserDefaults
Used symbols in binary ./XCFrameworkIntermediates/GoogleMaps/Base/GoogleMapsBase.framework/GoogleMapsBase: NSFileSystemFreeSize, NSURLContentModificationDateKey, NSURLCreationDateKey, NSUserDefaults, stat

And if that is so wouldn't I then need to add GoogleMapsPrivacy.bundle, GoogleMapsCorePrivacy.bundle, GoogleMapsBasePrivacy.bundle?

Is there a reason why you haven't added the privacy files as a resource to the framwork itself, like all the other SDK vendors has done?

sh...@tedokon.com <sh...@tedokon.com> #14Apr 17, 2024 02:26PM

In reality, I don't think the method provided by the Google Maps SDK for iOS documentation works properly.
I keep receiving emails warning `ITMS-91053: Missing API declaration` even when I include the GoogleMapsPrivacy.bundle in the target and submit it to Apple.
I think an approach as suggested by Apple engineers in the forum is needed.
Check the following link:

https://forums.developer.apple.com/forums/thread/746965

Also, I would like the documentation to detail more precise steps to prevent developers from getting confused.

yu...@google.com <yu...@google.com> #15Apr 18, 2024 10:04PM

On the pages listed in comment #7, we have provided more detailed instructions for manually adding the privacy manifest to your app. Please see comment #9 for acknowledgement about this manual method.

Regarding the persistent warnings reported in comment #10, comment #13, and comment #14: Although the published instructions should properly attach the required privacy manifest to your app, it is a known issue that the App Store Connect warnings currently do not get silenced. This known issue affects all static libraries using required reason APIs despite including privacy manifests.

ma...@umain.com <ma...@umain.com> #16Apr 19, 2024 05:49AM

"This known issue affects all static libraries using required reason APIs despite including privacy manifests."
Is this a known issue acknowledged by apple, in that case do you have a link to this?
I am asking because I don't want to end up in a situation on the first of may, where we cannot upload a fix for our app without needing to remove GoogleMaps from our application.

Message last modified on Apr 19, 2024 06:02AM

ig...@gmail.com <ig...@gmail.com> #17Apr 26, 2024 06:51PM

Apple provides some guidance regarding how to add a privacy manifest to static SDK distributions.

Are you planning to release an SDK that addresses the current warnings before the 1st of May?

ca...@google.com <ca...@google.com> Jun 3, 2024 06:54AM

Marked as fixed.

yu...@google.com <yu...@google.com> #18Jun 3, 2024 11:37PM

The Apple Privacy Manifest file is now included in the resources bundle for the SDK. For more information, see "Inspect the privacy manifest file" for the SDK you are using:
As of the release date of v9.0.0, Apple does not list Google Maps Platform SDKs for iOS among the third-party SDKs required to contain a signature in order for apps to pass App Store Connect review, so this version of the SDK does not contain a signature.